AIKIDO-2026-565238

TL;DR

MikroORM validates the field of an orderBy clause against entity metadata but applies no validation to the order direction, which is concatenated into the generated SQL ORDER BY clause after only a toLowerCase() call. An application that binds a request value to the order direction lets an attacker place a raw SQL fragment inside ORDER BY, enabling blind or boolean-based extraction of data the query never selects. The vulnerable code lives in the shared SQL layer, so all SQL drivers are affected while MongoDB is not. The fix allow-lists the direction against the known QueryOrder values in a shared helper on AbstractSqlPlatform, with the MySQL and MSSQL overrides routed through it.